Arbitrary Code Execution in Mozilla Sccache via LD_PRELOAD

CVE-2023-1521 is a high-severity vulnerability affecting Mozilla Sccache versions earlier than 0.4.0. The vulnerability resides in how the compiler cache utility handles environment variables during the process of invoking a compiler. Specifically, Sccache improperly respects the LD_PRELOAD environment variable when spawning compiler subprocesses. By leveraging this behavior, an attacker with local access to the system can point LD_PRELOAD to a malicious shared library. When Sccache executes a compiler command, it inadvertently loads the attacker-supplied library into the memory space of the compiler process. This mechanism facilitates arbitrary code execution with the privileges of the user running the Sccache utility, potentially leading to privilege escalation if the utility is executed by a high-privilege account or within a continuous integration pipeline.

Attack Chain

1. Attacker gains local access to a system where Mozilla Sccache (< 0.4.0) is installed.
2. Attacker crafts a malicious shared library (e.g., libpoc.so) containing the payload to be executed.
3. Attacker sets the LD_PRELOAD environment variable to the file path of the malicious shared library.
4. Attacker invokes the sccache command (e.g., 'sccache gcc foo.c -o foo') while the environment variable is active.
5. Sccache initiates the compiler subprocess (e.g., gcc).
6. The dynamic linker loads the malicious shared library into the compiler process due to the LD_PRELOAD directive.
7. The malicious code within the library executes within the context of the compiler process.

Impact

Successful exploitation allows for arbitrary code execution on the target system. This poses a significant risk to development environments, build servers, and CI/CD pipelines using older versions of Sccache, potentially leading to unauthorized access, exfiltration of credentials or source code, and persistence within the build infrastructure.

Recommendation

Prioritize the upgrade of Mozilla Sccache to version 0.4.0 or later to mitigate the vulnerability. Since exploitation requires local access, security teams should focus on monitoring for suspicious compiler invocations and unexpected library loads.

• Upgrade all instances of Mozilla Sccache to version 0.4.0 or newer immediately.
• Implement process monitoring on build servers to detect instances of 'sccache' being invoked with unusual environment variables or unexpected shared object (.so) files being loaded by compilers.